blob: c9ab62fa3e09b3b4729887e89c62e5951aa493cd [file] [log] [blame]
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +01001/*
2 * Elliptic curve DSA
3 *
4 * Copyright (C) 2006-2013, Brainspark B.V.
5 *
6 * This file is part of PolarSSL (http://www.polarssl.org)
7 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8 *
9 * All rights reserved.
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 */
25
26/*
27 * References:
28 *
29 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
30 */
31
32#include "polarssl/config.h"
33
34#if defined(POLARSSL_ECDSA_C)
35
36#include "polarssl/ecdsa.h"
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +020037#include "polarssl/asn1write.h"
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +010038
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010039#if defined(POLARSSL_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard7845fc02014-01-27 14:24:03 +010040#include "polarssl/hmac_drbg.h"
41#endif
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010042
Manuel Pégourié-Gonnard7845fc02014-01-27 14:24:03 +010043#if defined(POLARSSL_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard5e6edcf2014-01-07 16:17:53 +010044/*
45 * This a hopefully temporary compatibility function.
46 *
47 * Since we can't ensure the caller will pass a valid md_alg before the next
48 * interface change, try to pick up a decent md by size.
49 *
50 * Argument is the minimum size in bytes of the MD output.
51 */
Manuel Pégourié-Gonnard95924852014-03-21 10:54:55 +010052static const md_info_t *md_info_by_size( size_t min_size )
Manuel Pégourié-Gonnard5e6edcf2014-01-07 16:17:53 +010053{
54 const md_info_t *md_cur, *md_picked = NULL;
55 const int *md_alg;
56
57 for( md_alg = md_list(); *md_alg != 0; md_alg++ )
58 {
59 if( ( md_cur = md_info_from_type( *md_alg ) ) == NULL ||
Manuel Pégourié-Gonnard95924852014-03-21 10:54:55 +010060 (size_t) md_cur->size < min_size ||
Manuel Pégourié-Gonnard5e6edcf2014-01-07 16:17:53 +010061 ( md_picked != NULL && md_cur->size > md_picked->size ) )
62 continue;
63
64 md_picked = md_cur;
65 }
66
67 return( md_picked );
68}
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010069#endif
70
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +010071/*
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +010072 * Derive a suitable integer for group grp from a buffer of length len
73 * SEC1 4.1.3 step 5 aka SEC1 4.1.4 step 3
74 */
75static int derive_mpi( const ecp_group *grp, mpi *x,
76 const unsigned char *buf, size_t blen )
77{
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +010078 int ret;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +010079 size_t n_size = (grp->nbits + 7) / 8;
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +010080 size_t use_size = blen > n_size ? n_size : blen;
81
82 MPI_CHK( mpi_read_binary( x, buf, use_size ) );
83 if( use_size * 8 > grp->nbits )
84 MPI_CHK( mpi_shift_r( x, use_size * 8 - grp->nbits ) );
85
Manuel Pégourié-Gonnard461d4162014-01-06 10:16:28 +010086 /* While at it, reduce modulo N */
87 if( mpi_cmp_mpi( x, &grp->N ) >= 0 )
88 MPI_CHK( mpi_sub_mpi( x, x, &grp->N ) );
89
Manuel Pégourié-Gonnard53048122014-01-03 12:55:15 +010090cleanup:
91 return( ret );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +010092}
93
94/*
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +010095 * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
96 * Obviously, compared to SEC1 4.1.3, we skip step 4 (hash message)
97 */
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +020098int ecdsa_sign( ecp_group *grp, mpi *r, mpi *s,
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +010099 const mpi *d, const unsigned char *buf, size_t blen,
100 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
101{
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200102 int ret, key_tries, sign_tries, blind_tries;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100103 ecp_point R;
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200104 mpi k, e, t;
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100105
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100106 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
107 if( grp->N.p == NULL )
108 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
109
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100110 ecp_point_init( &R );
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200111 mpi_init( &k ); mpi_init( &e ); mpi_init( &t );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100112
113 sign_tries = 0;
114 do
115 {
116 /*
117 * Steps 1-3: generate a suitable ephemeral keypair
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100118 * and set r = xR mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100119 */
120 key_tries = 0;
121 do
122 {
123 MPI_CHK( ecp_gen_keypair( grp, &k, &R, f_rng, p_rng ) );
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100124 MPI_CHK( mpi_mod_mpi( r, &R.X, &grp->N ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100125
126 if( key_tries++ > 10 )
Paul Bakkercca998a2013-07-26 14:20:53 +0200127 {
Manuel Pégourié-Gonnard456d3b92013-09-16 18:04:38 +0200128 ret = POLARSSL_ERR_ECP_RANDOM_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200129 goto cleanup;
130 }
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100131 }
132 while( mpi_cmp_int( r, 0 ) == 0 );
133
134 /*
135 * Step 5: derive MPI from hashed message
136 */
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100137 MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100138
139 /*
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200140 * Generate a random value to blind inv_mod in next step,
141 * avoiding a potential timing leak.
142 */
143 blind_tries = 0;
144 do
145 {
146 size_t n_size = (grp->nbits + 7) / 8;
147 MPI_CHK( mpi_fill_random( &t, n_size, f_rng, p_rng ) );
148 MPI_CHK( mpi_shift_r( &t, 8 * n_size - grp->nbits ) );
149
150 /* See ecp_gen_keypair() */
151 if( ++blind_tries > 30 )
152 return( POLARSSL_ERR_ECP_RANDOM_FAILED );
153 }
154 while( mpi_cmp_int( &t, 1 ) < 0 ||
155 mpi_cmp_mpi( &t, &grp->N ) >= 0 );
156
157 /*
158 * Step 6: compute s = (e + r * d) / k = t (e + rd) / (kt) mod n
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100159 */
160 MPI_CHK( mpi_mul_mpi( s, r, d ) );
161 MPI_CHK( mpi_add_mpi( &e, &e, s ) );
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200162 MPI_CHK( mpi_mul_mpi( &e, &e, &t ) );
163 MPI_CHK( mpi_mul_mpi( &k, &k, &t ) );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100164 MPI_CHK( mpi_inv_mod( s, &k, &grp->N ) );
165 MPI_CHK( mpi_mul_mpi( s, s, &e ) );
166 MPI_CHK( mpi_mod_mpi( s, s, &grp->N ) );
167
168 if( sign_tries++ > 10 )
Paul Bakkercca998a2013-07-26 14:20:53 +0200169 {
Manuel Pégourié-Gonnard456d3b92013-09-16 18:04:38 +0200170 ret = POLARSSL_ERR_ECP_RANDOM_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200171 goto cleanup;
172 }
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100173 }
174 while( mpi_cmp_int( s, 0 ) == 0 );
175
176cleanup:
177 ecp_point_free( &R );
Manuel Pégourié-Gonnarddd75c312014-03-31 11:55:42 +0200178 mpi_free( &k ); mpi_free( &e ); mpi_free( &t );
Manuel Pégourié-Gonnardb309ab22013-01-26 17:24:59 +0100179
180 return( ret );
181}
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +0100182
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100183#if defined(POLARSSL_ECDSA_DETERMINISTIC)
184/*
185 * Deterministic signature wrapper
186 */
187int ecdsa_sign_det( ecp_group *grp, mpi *r, mpi *s,
188 const mpi *d, const unsigned char *buf, size_t blen,
189 md_type_t md_alg )
190{
191 int ret;
192 hmac_drbg_context rng_ctx;
Manuel Pégourié-Gonnardf42bca62014-01-06 15:05:01 +0100193 unsigned char data[2 * POLARSSL_ECP_MAX_BYTES];
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100194 size_t grp_len = ( grp->nbits + 7 ) / 8;
195 const md_info_t *md_info;
196 mpi h;
197
Manuel Pégourié-Gonnard5e6edcf2014-01-07 16:17:53 +0100198 /* Temporary fallback */
199 if( md_alg == POLARSSL_MD_NONE )
200 md_info = md_info_by_size( blen );
201 else
202 md_info = md_info_from_type( md_alg );
203
204 if( md_info == NULL )
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100205 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
206
207 mpi_init( &h );
208 memset( &rng_ctx, 0, sizeof( hmac_drbg_context ) );
209
Manuel Pégourié-Gonnardf42bca62014-01-06 15:05:01 +0100210 /* Use private key and message hash (reduced) to initialize HMAC_DRBG */
211 MPI_CHK( mpi_write_binary( d, data, grp_len ) );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100212 MPI_CHK( derive_mpi( grp, &h, buf, blen ) );
Manuel Pégourié-Gonnardf42bca62014-01-06 15:05:01 +0100213 MPI_CHK( mpi_write_binary( &h, data + grp_len, grp_len ) );
Manuel Pégourié-Gonnardfe34a5f2014-01-30 15:06:40 +0100214 hmac_drbg_init_buf( &rng_ctx, md_info, data, 2 * grp_len );
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100215
Manuel Pégourié-Gonnard4daaef72014-01-06 14:25:56 +0100216 ret = ecdsa_sign( grp, r, s, d, buf, blen,
217 hmac_drbg_random, &rng_ctx );
218
219cleanup:
220 hmac_drbg_free( &rng_ctx );
221 mpi_free( &h );
222
223 return( ret );
224}
Paul Bakker9f3c7d72014-01-23 16:11:14 +0100225#endif /* POLARSSL_ECDSA_DETERMINISTIC */
226
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100227/*
228 * Verify ECDSA signature of hashed message (SEC1 4.1.4)
229 * Obviously, compared to SEC1 4.1.3, we skip step 2 (hash message)
230 */
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +0200231int ecdsa_verify( ecp_group *grp,
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100232 const unsigned char *buf, size_t blen,
233 const ecp_point *Q, const mpi *r, const mpi *s)
234{
235 int ret;
236 mpi e, s_inv, u1, u2;
237 ecp_point R, P;
238
239 ecp_point_init( &R ); ecp_point_init( &P );
240 mpi_init( &e ); mpi_init( &s_inv ); mpi_init( &u1 ); mpi_init( &u2 );
241
Manuel Pégourié-Gonnard97871ef2013-12-04 20:52:04 +0100242 /* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
243 if( grp->N.p == NULL )
244 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
245
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100246 /*
247 * Step 1: make sure r and s are in range 1..n-1
248 */
249 if( mpi_cmp_int( r, 1 ) < 0 || mpi_cmp_mpi( r, &grp->N ) >= 0 ||
250 mpi_cmp_int( s, 1 ) < 0 || mpi_cmp_mpi( s, &grp->N ) >= 0 )
251 {
Manuel Pégourié-Gonnarddb771752013-08-27 15:11:23 +0200252 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200253 goto cleanup;
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100254 }
255
256 /*
257 * Additional precaution: make sure Q is valid
258 */
259 MPI_CHK( ecp_check_pubkey( grp, Q ) );
260
261 /*
262 * Step 3: derive MPI from hashed message
263 */
264 MPI_CHK( derive_mpi( grp, &e, buf, blen ) );
265
266 /*
267 * Step 4: u1 = e / s mod n, u2 = r / s mod n
268 */
269 MPI_CHK( mpi_inv_mod( &s_inv, s, &grp->N ) );
270
271 MPI_CHK( mpi_mul_mpi( &u1, &e, &s_inv ) );
272 MPI_CHK( mpi_mod_mpi( &u1, &u1, &grp->N ) );
273
274 MPI_CHK( mpi_mul_mpi( &u2, r, &s_inv ) );
275 MPI_CHK( mpi_mod_mpi( &u2, &u2, &grp->N ) );
276
277 /*
278 * Step 5: R = u1 G + u2 Q
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +0200279 *
280 * Since we're not using any secret data, no need to pass a RNG to
281 * ecp_mul() for countermesures.
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100282 */
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +0200283 MPI_CHK( ecp_mul( grp, &R, &u1, &grp->G, NULL, NULL ) );
284 MPI_CHK( ecp_mul( grp, &P, &u2, Q, NULL, NULL ) );
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100285 MPI_CHK( ecp_add( grp, &R, &R, &P ) );
286
287 if( ecp_is_zero( &R ) )
Paul Bakkercca998a2013-07-26 14:20:53 +0200288 {
Manuel Pégourié-Gonnarddb771752013-08-27 15:11:23 +0200289 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200290 goto cleanup;
291 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100292
293 /*
Manuel Pégourié-Gonnard178d9ba2013-10-29 10:45:28 +0100294 * Step 6: convert xR to an integer (no-op)
295 * Step 7: reduce xR mod n (gives v)
296 */
297 MPI_CHK( mpi_mod_mpi( &R.X, &R.X, &grp->N ) );
298
299 /*
300 * Step 8: check if v (that is, R.X) is equal to r
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100301 */
302 if( mpi_cmp_mpi( &R.X, r ) != 0 )
Paul Bakkercca998a2013-07-26 14:20:53 +0200303 {
Manuel Pégourié-Gonnarddb771752013-08-27 15:11:23 +0200304 ret = POLARSSL_ERR_ECP_VERIFY_FAILED;
Paul Bakkercca998a2013-07-26 14:20:53 +0200305 goto cleanup;
306 }
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100307
308cleanup:
309 ecp_point_free( &R ); ecp_point_free( &P );
310 mpi_free( &e ); mpi_free( &s_inv ); mpi_free( &u1 ); mpi_free( &u2 );
311
312 return( ret );
313}
314
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200315/*
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200316 * RFC 4492 page 20:
317 *
318 * Ecdsa-Sig-Value ::= SEQUENCE {
319 * r INTEGER,
320 * s INTEGER
321 * }
322 *
323 * Size is at most
324 * 1 (tag) + 1 (len) + 1 (initial 0) + ECP_MAX_BYTES for each of r and s,
325 * twice that + 1 (tag) + 2 (len) for the sequence
326 * (assuming ECP_MAX_BYTES is less than 126 for r and s,
327 * and less than 124 (total len <= 255) for the sequence)
328 */
329#if POLARSSL_ECP_MAX_BYTES > 124
330#error "POLARSSL_ECP_MAX_BYTES bigger than expected, please fix MAX_SIG_LEN"
331#endif
332#define MAX_SIG_LEN ( 3 + 2 * ( 2 + POLARSSL_ECP_MAX_BYTES ) )
333
334/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100335 * Convert a signature (given by context) to ASN.1
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200336 */
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100337static int ecdsa_signature_to_asn1( ecdsa_context *ctx,
338 unsigned char *sig, size_t *slen )
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200339{
340 int ret;
Manuel Pégourié-Gonnard4cf06862013-09-16 12:07:45 +0200341 unsigned char buf[MAX_SIG_LEN];
342 unsigned char *p = buf + sizeof( buf );
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200343 size_t len = 0;
344
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200345 ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->s ) );
346 ASN1_CHK_ADD( len, asn1_write_mpi( &p, buf, &ctx->r ) );
347
348 ASN1_CHK_ADD( len, asn1_write_len( &p, buf, len ) );
349 ASN1_CHK_ADD( len, asn1_write_tag( &p, buf,
350 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) );
351
352 memcpy( sig, p, len );
353 *slen = len;
354
355 return( 0 );
356}
357
358/*
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100359 * Compute and write signature
360 */
361int ecdsa_write_signature( ecdsa_context *ctx,
362 const unsigned char *hash, size_t hlen,
363 unsigned char *sig, size_t *slen,
364 int (*f_rng)(void *, unsigned char *, size_t),
365 void *p_rng )
366{
367 int ret;
368
369 if( ( ret = ecdsa_sign( &ctx->grp, &ctx->r, &ctx->s, &ctx->d,
370 hash, hlen, f_rng, p_rng ) ) != 0 )
371 {
372 return( ret );
373 }
374
375 return( ecdsa_signature_to_asn1( ctx, sig, slen ) );
376}
377
Paul Bakker9f3c7d72014-01-23 16:11:14 +0100378#if defined(POLARSSL_ECDSA_DETERMINISTIC)
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100379/*
380 * Compute and write signature deterministically
381 */
382int ecdsa_write_signature_det( ecdsa_context *ctx,
383 const unsigned char *hash, size_t hlen,
384 unsigned char *sig, size_t *slen,
385 md_type_t md_alg )
386{
387 int ret;
388
389 if( ( ret = ecdsa_sign_det( &ctx->grp, &ctx->r, &ctx->s, &ctx->d,
390 hash, hlen, md_alg ) ) != 0 )
391 {
392 return( ret );
393 }
394
395 return( ecdsa_signature_to_asn1( ctx, sig, slen ) );
396}
Paul Bakker9f3c7d72014-01-23 16:11:14 +0100397#endif /* POLARSSL_ECDSA_DETERMINISTIC */
Manuel Pégourié-Gonnard937340b2014-01-06 10:27:16 +0100398
399/*
Manuel Pégourié-Gonnardb694b482013-08-08 13:30:57 +0200400 * Read and check signature
401 */
402int ecdsa_read_signature( ecdsa_context *ctx,
403 const unsigned char *hash, size_t hlen,
404 const unsigned char *sig, size_t slen )
405{
406 int ret;
407 unsigned char *p = (unsigned char *) sig;
408 const unsigned char *end = sig + slen;
409 size_t len;
410
411 if( ( ret = asn1_get_tag( &p, end, &len,
412 ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
413 {
414 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
415 }
416
417 if( p + len != end )
418 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA +
419 POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
420
421 if( ( ret = asn1_get_mpi( &p, end, &ctx->r ) ) != 0 ||
422 ( ret = asn1_get_mpi( &p, end, &ctx->s ) ) != 0 )
423 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA + ret );
424
425 if( p != end )
426 return( POLARSSL_ERR_ECP_BAD_INPUT_DATA +
427 POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
428
429 return( ecdsa_verify( &ctx->grp, hash, hlen, &ctx->Q, &ctx->r, &ctx->s ) );
430}
431
432/*
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200433 * Generate key pair
434 */
435int ecdsa_genkey( ecdsa_context *ctx, ecp_group_id gid,
436 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
437{
438 return( ecp_use_known_dp( &ctx->grp, gid ) ||
439 ecp_gen_keypair( &ctx->grp, &ctx->d, &ctx->Q, f_rng, p_rng ) );
440}
441
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200442/*
443 * Set context from an ecp_keypair
444 */
445int ecdsa_from_keypair( ecdsa_context *ctx, const ecp_keypair *key )
446{
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100447 int ret;
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200448
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100449 if( ( ret = ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 ||
450 ( ret = mpi_copy( &ctx->d, &key->d ) ) != 0 ||
451 ( ret = ecp_copy( &ctx->Q, &key->Q ) ) != 0 )
452 {
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200453 ecdsa_free( ctx );
Manuel Pégourié-Gonnard1001e322013-10-27 14:53:48 +0100454 }
Manuel Pégourié-Gonnardf4999932013-08-12 17:02:59 +0200455
456 return( ret );
457}
Manuel Pégourié-Gonnard8eebd012013-08-09 16:21:34 +0200458
459/*
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200460 * Initialize context
461 */
462void ecdsa_init( ecdsa_context *ctx )
463{
464 ecp_group_init( &ctx->grp );
465 mpi_init( &ctx->d );
466 ecp_point_init( &ctx->Q );
467 mpi_init( &ctx->r );
468 mpi_init( &ctx->s );
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200469}
470
471/*
472 * Free context
473 */
474void ecdsa_free( ecdsa_context *ctx )
475{
476 ecp_group_free( &ctx->grp );
477 mpi_free( &ctx->d );
478 ecp_point_free( &ctx->Q );
479 mpi_free( &ctx->r );
480 mpi_free( &ctx->s );
Manuel Pégourié-Gonnard7c8934e2013-06-27 12:54:02 +0200481}
Manuel Pégourié-Gonnard3aeb5a72013-01-26 18:05:50 +0100482
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +0100483#if defined(POLARSSL_SELF_TEST)
484
485/*
486 * Checkup routine
487 */
488int ecdsa_self_test( int verbose )
489{
Manuel Pégourié-Gonnard7c593632014-01-20 10:27:13 +0100490 ((void) verbose );
491 return( 0 );
Manuel Pégourié-Gonnard2aea1412013-01-26 16:33:44 +0100492}
493
494#endif
495
496#endif /* defined(POLARSSL_ECDSA_C) */